The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses osascript (AppleScript) to programmatically control macOS Terminal.app or iTerm2 to open new tabs and execute shell commands (cd and claude).
[DYNAMIC_EXECUTION]: The scripts/sidequest.sh script is vulnerable to command injection. It takes the --task and --context arguments (which contain user input and agent-generated summaries) and interpolates them into a shell command string that is executed in a new terminal session. The escape_for_applescript function only handles double quotes, backslashes, and newlines, but fails to escape or sanitize shell-specific metacharacters such as backticks (`), dollar signs ($), or semicolons (;). Consequently, a task description like $(open /Applications/Calculator.app) would be evaluated and executed by the shell in the newly spawned terminal.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant vulnerability surface by ingesting untrusted data—specifically user-provided task descriptions and summarized session context—and passing it directly into a shell execution context without adequate sanitization. This allows malicious or malformed input to escape the intended prompt string and trigger unintended system commands.

sidequest